ReproCase 1.3.0-beta.1

New: case templates. Save a case you proved, then reuse it on another target you're allowed to test.

What's new

• Save as template. Keeps the case logic only. Accounts, target addresses, cookies, tokens and run evidence are removed, the same way as an export.
• Templates → Use on a target. You type the target yourself: ReproCase never picks, suggests or searches for targets, and each template case covers one target.
  • If that API uses different paths, map them first. {placeholders} must stay the same, and a path can't point to another host.
  • The new case starts unapproved, with no accounts connected. Connect two test accounts you created there (for example with Verify on my site), then approve and run.
  • If a program is saved, the target is checked against its scope when the case is created, and every request of the run is checked again.
• Built-in templates from templates/: horizontal IDOR read/write, vertical privilege, role, CORS and write proofs. Templates download and import as JSON; a ReproCase package can be imported as a template (its evidence is dropped).

Download

Platform	File
Windows x64	ReproCase-1.3.0-beta.1-Windows-x64.zip
macOS Apple silicon	ReproCase-1.3.0-beta.1-macOS-arm64.zip
macOS Intel	ReproCase-1.3.0-beta.1-macOS-x64.zip
Linux x64	ReproCase-1.3.0-beta.1-Linux-x64.tar.gz

Verify: gh attestation verify <file> --repo theasbug/reprocase and compare with ReproCase-1.3.0-beta.1-SHA256SUMS.txt. The Burp extension is attached too.

Full list: CHANGELOG

ReproCase 1.2.0-beta.1

New: controlled write proofs, role checks and browser CORS proofs. Everything still runs only against your own test accounts and obeys the program scope, exclusion, rate and budget policy.

What's new

• Write IDOR in five inputs. Target, two accounts, one create request and one change request (PATCH/PUT/POST, JSON or form). A separate authorized control object and a fresh test object; the owner's before/after read proves a real change, not just an HTTP 200.
• Role / function checks. Compare live roles and an anonymous control, for reads (no create request needed) and for writes on objects the run created.
• Browser CORS proofs. Real JavaScript reads from a foreign and a null origin in Chromium with the account's cookie, so browser security rules stay intact. A 403 that still exposes private data counts as a disclosure.
• Stop and cleanup: after you cancel, no new requests are sent (cleanup included); leftover object addresses are shown and removed from shareable evidence.
• v1 cases keep working. Docs: docs/QUICK-PROOF-V2.en.md and docs/QUICK-PROOF-V2.tr.md.

Download

Platform	File
Windows x64	ReproCase-1.2.0-beta.1-Windows-x64.zip
macOS Apple silicon	ReproCase-1.2.0-beta.1-macOS-arm64.zip
macOS Intel	ReproCase-1.2.0-beta.1-macOS-x64.zip
Linux x64	ReproCase-1.2.0-beta.1-Linux-x64.tar.gz

Verify: gh attestation verify <file> --repo theasbug/reprocase and compare with ReproCase-1.2.0-beta.1-SHA256SUMS.txt. Burp extension is attached too.

Full list: CHANGELOG

ReproCase 1.1.0-beta.7

Security fix release. Update from beta.6.

Fixed

• Identity checks now follow your program policy. Connecting an account, checking accounts and Quick proof identity detection now respect the program's scope, exclusions, rate limit and request budget, like runs already did. An out-of-scope or excluded identity path is refused instead of being requested.
• Form creation stays a form. When Quick proof observes a form-encoded creation request, the saved case now sends the proof run's creation as a form too (it was sent as JSON before).
• Quick proof cleans up after a failed read. The object created to observe the API is deleted even when a later read fails; if deletion fails, the message names the object URL so you can remove it.

Download

Platform	File
Windows x64	ReproCase-1.1.0-beta.7-Windows-x64.zip
macOS Apple silicon	ReproCase-1.1.0-beta.7-macOS-arm64.zip
macOS Intel	ReproCase-1.1.0-beta.7-macOS-x64.zip
Linux x64	ReproCase-1.1.0-beta.7-Linux-x64.tar.gz

Verify: gh attestation verify <file> --repo theasbug/reprocase and compare with ReproCase-1.1.0-beta.7-SHA256SUMS.txt. Burp extension: reprocase-burp-0.1.0.jar.

Full list: CHANGELOG

ReproCase 1.1.0-beta.6

ReproCase now runs on macOS and Linux.

Until now, the desktop app was Windows-only. Now there's a download for every computer:

Your computer	File	How to open
Windows	ReproCase-1.1.0-beta.6-Windows-x64.zip	Extract the whole archive and open ReproCase.exe.
Mac with Apple silicon (M1–M4)	ReproCase-1.1.0-beta.6-macOS-arm64.zip	Unzip, move ReproCase to Applications, then right-click → Open the first time.
Mac with Intel	ReproCase-1.1.0-beta.6-macOS-x64.zip	Same as above.
Linux (x64)	ReproCase-1.1.0-beta.6-Linux-x64.tar.gz	Extract and run ./ReproCase.

Every app includes everything: Quick proof, Verify on my site, the demo, Burp import, and IDOR leads from Arjun/ffuf. No Node.js, Python or Docker needed.

Good to know

• macOS: the app isn't code-signed yet, so macOS blocks a normal double-click the first time. Right-click → Open → Open, or run xattr -dr com.apple.quarantine /Applications/ReproCase.app once.
• Linux: on Ubuntu 24.04 and newer, Electron apps need permission to use their sandbox. If the app doesn't start, see the Linux notes.
• Your data: on macOS it's stored in ~/Library/Application Support/ReproCase, on Linux in ~/.config/ReproCase. Windows stays portable, with ReproCase-data next to the exe.
• Saved AI keys use your system's key store (Keychain, GNOME Keyring/KWallet, Windows DPAPI). On Linux without a keyring, keys are not saved rather than stored as plain text.
• The AI assistant's desktop-control tools (screenshots, mouse, keyboard) are Windows-only for now. Everything else works the same on every platform.

How it was tested

Each package was built on its own operating system by GitHub Actions and smoke-tested there: the packaged app started, the bundled Chromium worked, and the demo ran through to Reproduced. The four platforms were Windows, macOS Apple silicon, macOS Intel and Linux. The maintainer has not yet tried the macOS and Linux apps by hand, so please report anything odd.

Verify your download

ReproCase-1.1.0-beta.6-SHA256SUMS.txt covers all four archives. Each one also has a build-provenance attestation:

gh attestation verify ReproCase-1.1.0-beta.6-macOS-arm64.zip --repo theasbug/reprocase

Docker: docker run --rm -p 127.0.0.1:4317:4317 ghcr.io/theasbug/reprocase:1.1.0-beta.6
Burp extension: reprocase-burp-0.1.0.jar (Java 17+)

Full changelog: v1.1.0-beta.5...v1.1.0-beta.6

ReproCase 1.1.0-beta.5

Important

Newer versions are available. See the latest releases for the current download.

Easier to read, easier to start.

This beta makes ReproCase friendlier to use day to day.

What's new

• Sign in like normal. In Quick proof, choose Sign in and ReproCase opens a separate browser window. Log in to your test account there. There's nothing to copy from DevTools, though pasting a header, token or cookie still works.
• Clear answers when something is off. If ReproCase can't recognize your accounts, it shows every path it tried, what each account got back and what an HTTP 401 means, so you know what to fix.
• A "Next step" guide on every case. One line tells you what's left: acknowledge the policy, enter the target, connect accounts, approve and run.
• Larger, easier-to-read text throughout the app, on desktop and mobile.
• Tidier import window. Tabs are grouped into Evidence (HAR, raw HTTP, Burp, Postman, package) and IDOR leads (Arjun, ffuf).

If you're new: Quick proof turns two test accounts and two copied requests into a case that anyone can rerun with their own accounts. Triagers can open a reporter's package and use Verify on my site. How it works.

Download

File	For
ReproCase-1.1.0-beta.5-Windows-x64.zip	Windows portable app. Extract the whole archive and open ReproCase.exe.
reprocase-burp-0.1.0.jar	Burp Suite extension (Java 17+)
ReproCase-1.1.0-beta.5-source.zip	Source archive
ReproCase-1.1.0-beta.5-SHA256SUMS.txt	Checksums

Docker: docker run --rm -p 127.0.0.1:4317:4317 ghcr.io/theasbug/reprocase:1.1.0-beta.5

Verify: gh attestation verify ReproCase-1.1.0-beta.5-Windows-x64.zip --repo theasbug/reprocase. The Windows executable is not code-signed yet. When upgrading, extract into a new folder and keep your ReproCase-data.

Full changelog: v1.1.0-beta.4...v1.1.0-beta.5

ReproCase 1.1.0-beta.4

Important

Newer versions are available. See the latest releases for the current download.

Prove an IDOR in four steps, on an API ReproCase has never seen.

Until now, a real target meant describing its mechanism by hand: about 25 fields, a dozen of them JSON Pointers. Quick proof learns the mechanism by watching instead. You give it the target, two test accounts and two pasted requests.

New: Quick proof

1. Accounts. Paste a session for two test accounts you control: any auth header (Authorization, X-Auth-Token, …), a Bearer token, or a cookie.
2. Identity. ReproCase calls common "who am I" endpoints with both accounts and finds the account ID and organization fields by comparing the answers. Wrong guess? Click the right field.
3. Requests. Paste the request that creates an object and the vulnerable request that reads it by ID, straight from Burp or DevTools. Headers are ignored, so captured cookies are never stored.
4. Result. ReproCase creates one object as account A and learns where the new ID, the owner and a marker field are. It detects CSRF tokens if needed, previews account B's access, deletes the object and saves the case.

You then review the policy, approve and run. The verdict comes from the normal run: a fresh object, a unique marker, verified accounts.

New for triagers: Verify on my site

Import the reporter's .reprocase.json, enter your API origin and one credential per test account. If your identity endpoint or fields differ from the reporter's, ReproCase finds them and saves a new case revision, so there's no JSON to edit. The reporter's policy acknowledgement is not imported: you read the claim and approve it yourself.

Also

• Any custom auth header for account sessions, not only Bearer tokens and cookies.
• A read witness can now check that the response contains the run marker anywhere, so no response field location is needed.
• Imported and recon drafts no longer require a /role field.
• Target-facing verification runs one at a time per case.

How it was tested: on a second lab deliberately shaped unlike the demo: /api/v1/profile, wrapped UUID objects, an X-Auth-Token header, x-xsrf-token CSRF and 401 denials. Results: reproduced, not reproduced, cross-user and same-person inconclusive all came out correctly, both through the API and by clicking through the UI. 159 unit/integration tests and 8 browser tests pass.

Current limits: Quick proof covers read IDORs with the object ID in the URL path. Use Advanced case for write IDORs or role checks.

Download

File	For
ReproCase-1.1.0-beta.4-Windows-x64.zip	Windows portable app. Extract the whole archive and open ReproCase.exe.
reprocase-burp-0.1.0.jar	Burp Suite extension (Java 17+)
ReproCase-1.1.0-beta.4-source.zip	Source archive
ReproCase-1.1.0-beta.4-SHA256SUMS.txt	Checksums

Docker: docker run --rm -p 127.0.0.1:4317:4317 ghcr.io/theasbug/reprocase:1.1.0-beta.4

Verify: gh attestation verify ReproCase-1.1.0-beta.4-Windows-x64.zip --repo theasbug/reprocase. The Windows executable is not code-signed yet. When upgrading, extract into a new folder and keep your ReproCase-data.

Full changelog: v1.1.0-beta.3...v1.1.0-beta.4

ReproCase 1.1.0-beta.3

Important

Newer versions are available. See the latest releases for the current download.

Find the IDOR leads worth proving.

ReproCase already turns an IDOR into a case anyone can rerun with fresh accounts. This beta adds the step before that: it takes the output of the tools you already run and points at the requests most likely to be IDORs.

New: IDOR candidates from Arjun and ffuf

Paste Arjun (-oJ) or ffuf (-of json) output into Import evidence → Arjun / ffuf. ReproCase ranks every result by identifier signals:

• ID-like parameter names such as order_id, user_id and invoice_no
• Object IDs in paths, weighted higher after resource words like /users/1042
• Fuzzed IDs that returned a 2xx response

ffuf hits that differ only by an ID are grouped into one lead. Click Create draft and the lead becomes a case. Its identifiers are already turned into fresh-binding placeholders, ready for your two test accounts.

Safe by design: ranking is fully offline, and no request is sent to the target. Captured Cookie and Authorization headers are never copied into a draft.

From a source checkout:

npm run cli -- candidates arjun.json            # ranked leads
npm run cli -- candidates ffuf.json --draft 1   # case draft from lead #1

For AI agents, the MCP tool is idor_candidates.

Also in this release

• Dependencies: electron 45.3.0, lucide-react 0.577.
• CI: GitHub Actions updated (setup-node v7, upload-artifact v7, attest-build-provenance v4, setup-java v6, docker/login-action v4). Dependabot now opens only minor/patch npm updates.

Download

File	For
ReproCase-1.1.0-beta.3-Windows-x64.zip	Windows portable app. Extract the whole archive and open ReproCase.exe.
reprocase-burp-0.1.0.jar	Burp Suite extension (unchanged; Java 17+)
ReproCase-1.1.0-beta.3-source.zip	Source archive
ReproCase-1.1.0-beta.3-SHA256SUMS.txt	Checksums

Docker: docker run --rm -p 127.0.0.1:4317:4317 ghcr.io/theasbug/reprocase:1.1.0-beta.3

Verify: gh attestation verify ReproCase-1.1.0-beta.3-Windows-x64.zip --repo theasbug/reprocase. The Windows executable is not code-signed yet. When upgrading, extract into a new folder and keep your ReproCase-data.

Full changelog: v1.1.0-beta.2...v1.1.0-beta.3

ReproCase 1.1.0-beta.2

Important

Newer versions are available. See the latest releases for the current download.

HTTP 200 is not proof of an IDOR. ReproCase checks whether the boundary was actually crossed.

This beta takes ReproCase beyond Windows and into Burp Suite, adds ready-made case templates, and makes every download verifiable.

New

• Docker (Linux, macOS, Windows). Run the workbench, case runner and demo lab with headless Chromium:

  docker run --rm -p 127.0.0.1:4317:4317 ghcr.io/theasbug/reprocase:1.1.0-beta.2

  Open the http://localhost:4317/#token=... URL from the logs. Use docker compose up from a checkout to keep data in a volume.
• Burp Suite extension. Install reprocase-burp-0.1.0.jar (Extensions → Add → Java), point it at ReproCase's runtime.json, then right-click requests → Send to ReproCase. The selection becomes a case draft. Nothing is sent to the target, and captured session credentials are not copied into the case. Guide
• Case templates. Schema-valid starting points for horizontal IDOR (read and write) and vertical privilege / BFLA in templates/.
• Verifiable builds. The Windows archive, source archive, Burp jar and container image are built by GitHub Actions from this tag, with signed build-provenance attestations:

  gh attestation verify ReproCase-1.1.0-beta.2-Windows-x64.zip --repo theasbug/reprocase

Changed

• The README is rewritten around reproducible IDOR/BOLA proofs. The AI assistant and recon utilities are still included, as optional extras.
• Moderate minimatch/glob advisories are resolved in the packaging dependencies (npm audit: 0).

Download

File	For
ReproCase-1.1.0-beta.2-Windows-x64.zip	Windows portable app. Extract the whole archive and open ReproCase.exe.
reprocase-burp-0.1.0.jar	Burp Suite extension (Java 17+)
ReproCase-1.1.0-beta.2-source.zip	Source archive
ReproCase-1.1.0-beta.2-SHA256SUMS.txt	Checksums

The Windows executable is not code-signed yet. Verify it with the checksum file or gh attestation verify. Keep ReproCase-data when upgrading: extract the new version into a separate folder and copy your data across (desktop notes).

Try it in two minutes: load the built-in demo, run it (Reproduced), refresh the identities and run again (Reproduced), then switch to the secure target (Not reproduced). No API key needed. Found something confusing? Five-minute beta test.

Full changelog: v1.1.0-beta.1...v1.1.0-beta.2

ReproCase 1.1 Beta — Fresh accounts. Reproducible proofs.

Important

Newer versions are available. See the latest releases for the current download.

Fresh accounts. Reproducible proofs.

The first public beta of ReproCase: an open-source AI workbench for bug bounty research, with a deterministic engine for reproducing IDOR/BOLA and cross-tenant authorization cases using new accounts and resources.

Download and start

• Windows x64: download ReproCase-1.1.0-beta.1-Windows-x64.zip, extract the entire archive into a writable folder and open ReproCase.exe. Electron and Chromium are included; no Node.js, Python or Docker installation is required.
• Source: clone this repository, download ReproCase-1.1.0-beta.1-source.zip, or use GitHub's tag source archives. Source builds require Node.js 24.18+.
• Verify: compare the downloaded files with ReproCase-1.1.0-beta.1-SHA256SUMS.txt.

Start with the built-in local demo: run a case, refresh the identities, repeat, then switch to the secure target. No AI account or API key is required for the demo or deterministic proof engine.

What is included

• Explicit live identity, tenant, role and resource-ownership checks, fresh ID/CSRF bindings, evidence witnesses and three distinct verdicts.
• HAR/raw HTTP/Burp/Postman import, guided case editing, preflight, run comparison, reviewed case packages and HTML/Markdown reporting.
• AI sessions with provider/model discovery, supported reasoning controls, tool activity, usage/speed, follow-ups during work, local file/terminal tools, native Windows computer control and MCP connections.
• Program scope and exclusions, bounded CT/HTTP helpers, JWT/JS/traffic analysis, CVSS v3.1 and finding tracking.
• English/Turkish UI and detailed guides.

Reliability work in this beta

Scope retains scheme, port and path boundaries; unknown programs fail closed. Managed requests share program-wide rate limits, budgets and cancellation. Session-only program headers stay out of saved metadata. Playwright proof exports reuse the core runner and session transport, so denied preparation cannot turn into a passing proof.

Local Windows verification: 137 unit/integration tests, five Chromium product flows and a packaged-executable smoke test. Hosted Linux and Windows source checks, Chromium product flows, and the Windows packaged-executable test also passed in the release verification run. See verification notes.

Beta boundaries

• The Windows executable is unsigned. Native Linux/macOS computer control is not implemented; their source/web workflows are experimental.
• Managed network policies do not sandbox arbitrary terminal commands, desktop actions or third-party MCP tools. Autonomous permissions are an explicit choice. Ctrl+Alt+Esc cancels active agent work and managed scans, without undoing effects already dispatched.
• Playwright exports require a ReproCase source checkout and local credentials. Hurl exports are request drafts, not security proofs. Recon observations need verification.
• Pre-publication audit: zero runtime advisories; five moderate affected development-package records remain in Electron packaging dependencies.
• Provider access, quotas and reasoning visibility depend on your account and model; current tests use a local provider fixture. Historical live-provider records are labeled separately.

Keep ReproCase-data private and back it up before upgrading. Extract this release into a new folder rather than overwriting an older installation. Published archives were inspected for local user data and credentials. Strict scanning of bundled dependencies also flagged public test/example strings; these were verified against the unmodified locked dependency files. See release checks.

Türkçe: Yeni sürümler Releases sayfasında. Windows ZIP'ini tamamen çıkarıp ReproCase.exe dosyasını açın. Yerel demoyu API anahtarı olmadan deneyebilirsiniz. Türkçe hızlı başlangıç · Ayrıntılı kılavuz

Apache-2.0 · Report a bug · Contribute